Privacy Policy

Last updated September 20, 2026.

The short version: we collect the minimum data needed to run your help center, live chat, and shared inbox. Your content is yours. We never sell your data. Our product analytics are privacy-first and cookie-free. We run advertising measurement on our marketing site and app only — never inside your help center or widget — and we honor Global Privacy Control. We name every third-party service that touches your data.

Who we are

The privacy of your data — and it is your data, not ours — is a big deal to us. We’re a small, bootstrapped company. We don’t have investors pressuring us to monetize your information. We don’t sell data. Our business model is simple: you pay us for customer support software, we host it well.

When we say “we,” we mean M&S CapitalSoft LLC, the company behind Selvo (selvo.co). When we say “you,” we mean you — the person or organization using Selvo. When we say “your customers,” we mean the people who visit your help center or message you through Selvo.

Legal basis for processing

We process your data under four legal bases:

Contract. We need your account information and content to provide the service you signed up for.
Legitimate interest. We use anonymous analytics to improve the product and log API usage for security. These don’t override your privacy because we minimize data collection and don’t track individuals.
Consent. Advertising measurement on our own marketing site and app runs on this basis. You can withdraw it at any time — see “How to opt out” below.
Legal obligation. We keep certain records when required by tax or other laws.

What we collect and why

Account information

We collect your name and email address when you create an account. We use this to identify you, log you in, and send you important product emails (password resets, workspace invitations, security notices). That’s it.

Billing information

We use Stripe to process payments. Your card number, expiration date, and billing details go directly to Stripe. We never see, store, or have access to your full card details. We receive only a transaction reference and your plan status so we know what features to enable.

Your content

When you create articles and collections or upload images, we store that content so we can display your help center. You own your content. We don’t use it for anything other than providing and improving the service. Uploaded images and files are stored in Google Cloud Storage. Article images in published help centers are publicly accessible — that’s how your visitors can see them.

Conversations with your customers

Live chat and the shared inbox mean we store messages your customers send you, along with the contact details they provide and basic technical context about their session. We process this on your behalf, as your processor — you decide what to collect and how long to keep it. We don’t use the contents of your customer conversations to train models or for any purpose other than delivering the service to you.

AI features

When the AI agent handles a conversation, the relevant message content and your published help center articles are sent to a third-party model provider to generate a reply. We use Anthropic, OpenAI, and Google for this. These providers process the content to return a response and do not train their models on it. If you don’t want conversation content leaving our infrastructure, don’t enable the AI agent.

Product analytics

We use Umami, a privacy-first analytics tool we self-host on our own infrastructure (analytics.selvo.co). Umami tracks page views across our marketing site (selvo.co), the dashboard (app.selvo.co), and your published help centers.

For each page view, Umami collects the page URL, referrer, browser, operating system, device type, and country. It hashes the visitor’s IP address and user agent into an anonymous identifier — no raw IP addresses are stored. No cookies. No cross-site tracking. No personal data. We also track anonymous custom events, like which buttons visitors click, to understand how people use the product. All analytics data stays on our own infrastructure.

Cookies

We use session cookies on the dashboard (app.selvo.co) to keep you logged in. These are scoped to .selvo.co so authentication works across the dashboard. We use advertising cookies on selvo.co and app.selvo.co only, described in the next section. We set no advertising or tracking cookies inside your published help center or the chat widget your customers see.

Advertising measurement

We advertise Selvo on X and Meta, and we measure whether those ads work. This runs on Selvo’s own marketing site and app. Customer help centers and embedded widgets do not load these pixels.

We use the X pixel on selvo.co and app.selvo.co to measure visits, trial-button clicks, completed trials, product activation, and paid checkouts. A first-party cookie remembers the most recent X ad click for up to 90 days across both domains. Browser storage helps avoid duplicate milestone events. X may also set its own advertising cookies.

When enabled, we also use Meta’s Pixel on public marketing pages to measure page views and trial-button clicks. Inside the Selvo app, we send trial, product activation, and confirmed checkout events through Meta’s server API; the Meta browser script does not load in the app. Meta click attribution cookies may persist for up to 90 days across selvo.co and app.selvo.co. Automatic Advanced Matching is off.

Conversion events include an event identifier and, for paid checkouts, the amount and currency, plus browser or ad-click identifiers and browser information. We do not add email addresses, phone numbers, support messages, workspace names, or tool inputs to these events. Both integrations respect Global Privacy Control and previously saved advertising refusals.

How to opt out

Turn on Global Privacy Control in your browser and we stop advertising measurement for you automatically — no account needed, nothing to find on our side. GPC is built into some browsers and available as an extension for the rest; see globalprivacycontrol.org for how to enable it in yours. Blocking third-party scripts or clearing cookies for selvo.co works too. If you’d rather we handled it, email hello@selvo.co and we’ll take care of it.

See X’s Privacy Policy and Meta’s Privacy Policy for information about their processing.

API access

If you use our API, including the MCP server for AI tools, we log your API key usage for security and rate limiting. We don’t log the content of your API requests.

Third-party services we use

Here’s every service that handles your data, what it does, and a link to its privacy policy:

Vercel — hosts the application, serves your help center pages, provisions SSL certificates for custom domains, and hosts our self-hosted analytics instance.
Neon — hosts our PostgreSQL databases, including account data, your content, customer conversations, and anonymous analytics.
Stripe — processes payments and handles all credit card data directly.
Resend — sends transactional email (password resets, workspace invitations, notifications).
Google Cloud Storage — stores images and files you upload.
Anthropic, OpenAI, and Google — generate AI agent replies when you enable AI features.
X and Meta — advertising measurement on our marketing site and app only.

When we share your information

To provide the service. Your help center content is published publicly — that’s the point of a help center. Workspace members you invite can see your workspace content.
With the processors listed above. Each handles a specific part of the service as described.
If required by law. If a government authority makes a legally valid request, we comply with the minimum necessary. We’d notify you unless legally prohibited from doing so.
If the company is acquired. If Selvo is sold, your data transfers to the new owner under the same commitments. We’d notify you before this happens.

We never sell your personal data. We never will.

Your rights

Regardless of where you live, we provide the same rights to everyone:

Access. Request a copy of all data we have about you.
Correction. Fix any inaccurate information.
Deletion. Ask us to delete your account and all associated data.
Export. Download your help center content and customer conversations.
Object. Object to how we use your data.

To exercise any of these rights, email hello@selvo.co. We respond within 30 days. If you’re in the EU or UK, you also have the right to file a complaint with your local data protection authority.

Where your data lives

Our infrastructure and file storage are hosted in the United States. If you’re outside the US, your data crosses borders. Our processors maintain appropriate safeguards for international transfers, which you can review in their privacy policies linked above.

Data security

We use HTTPS everywhere. Your data is encrypted in transit and at rest. We use session-based authentication with secure cookies. Access to production systems is restricted. Stripe handles all payment card data in their PCI-compliant environment — card details never touch our servers.

No system is 100% secure. We can’t guarantee absolute security, but we treat your data like we’d want ours treated.

Data retention and deletion

We keep your data for as long as your account is active. If you cancel, we keep your data for 30 days in case you come back, then permanently delete it. Some data persists in encrypted backups for up to 90 days, after which backups cycle out. If you delete individual articles, conversations, or files, they’re removed from our active systems promptly and backup retention applies the same way.

We keep anonymized analytics data indefinitely because it contains no personal information.

Children

Selvo is not directed at children under 16. We don’t knowingly collect data from children. If we learn we’ve collected data from a child, we’ll delete it.

Changes to this policy

If we make significant changes to this policy, we’ll notify you by email before they take effect. For minor clarifications or formatting changes, we’ll update the “Last updated” date.

Questions

Have a question or concern? Email us at hello@selvo.co.

M&S CapitalSoft LLC
312 W 2nd St, Unit #A3467
Casper, WY 82601

Adapted from Basecamp’s open-source policies, available under CC BY 4.0.